Skip to content

ci: nuget publish via Trusted Publishing (OIDC), drop long-lived API key #629

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Nucs wants to merge 1 commit into
base: master
Choose a base branch
from
Open

ci: nuget publish via Trusted Publishing (OIDC), drop long-lived API key #629

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 27 additions & 1 deletion .github/workflows/build-and-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -685,6 +685,22 @@ jobs:
if: needs.validate-release.outputs.is_valid == 'true'
runs-on: ubuntu-latest

# Trusted Publishing (OIDC) — no long-lived API key. GitHub mints a short-lived, signed OIDC
# token (id-token: write); NuGet/login POSTs it to nuget.org's token endpoint, which validates
# the token's repo-owner / repo / workflow-file claims against the Trusted Publishing policy
# registered under the SciSharp owner (workflow file .github/workflows/build-and-release.yml, no
# environment, scope "Push new packages and package versions", glob *NumSharp*) and returns a
# temporary API key valid for 1 hour. The push then uses that key.
#
# A job-level permissions block REPLACES the top-level `write-all` for THIS job, so id-token is
# granted explicitly (write-all's coverage of id-token is not something to rely on) and the rest
# is least-privilege: contents:read is unused here (no checkout) but harmless; actions:read lets
# download-artifact read this run's nuget-packages artifact.
permissions:
id-token: write
contents: read
actions: read

steps:
- name: Download NuGet Packages
uses: actions/download-artifact@v7
Expand All @@ -699,12 +715,22 @@ jobs:
8.0.x
10.0.x

# Exchange the GitHub OIDC token for a short-lived nuget.org API key. `user` is the nuget.org
# account USERNAME (profile name, NOT an email) that owns the Trusted Publishing policy; set it as
# the NUGET_USER repo secret. Requested here, immediately before the push, so the 1-hour temp key
# cannot expire before use. Output: steps.nuget-login.outputs.NUGET_API_KEY.
- name: NuGet login (OIDC trusted publishing)
uses: NuGet/login@v1
id: nuget-login
with:
user: ${{ secrets.NUGET_USER }}

- name: Push to NuGet
run: |
for package in artifacts/*.nupkg; do
echo "Pushing $package..."
dotnet nuget push "$package" \
--api-key ${{ secrets.NUGETAPIKEY }} \
--api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} \
--source https://api.nuget.org/v3/index.json \
--skip-duplicate
done
Loading